Copilot Studio Agent with Manual Authentication to SharePoint knowledge

(1) Share

Report

Posted on by SanjayAdsure201

Hi everyone,

I have created a Copilot Studio agent with Manual Authentication using MS Entra ID with Client Secret option selected. Have provided below MS Graph API Permissions to app:

Added some site pages link to knowledge sources but the copilot unable to get result from them. If I switch the authentication to MS Entra ID I can get result from SharePoint but not with Manual Authentication. I want to use this agent in custom site (React + Python) so I am trying to implement it using Manual Authentication.
Any help will be highly appreciated.

Thanks,

Sanjay

Categories:

Copilot Studio skills development

I have the same question (0)

All responses (5)

Answers (0)

Suggested answer

AP-26031104-0 Microsoft Employee on at

Like (0)

Report
Copy link

Link copied!
Hi SanjayAdsure201,

The behavior you’re seeing is expected due to the difference in authentication context:

MS Entra ID authentication (default): The Copilot agent uses the app’s identity with delegated permissions, which allows it to query SharePoint on behalf of a user and retrieve site pages.

Manual Authentication (Client Secret): This uses the client credentials flow, which provides application permissions instead of delegated permissions. Some Graph API endpoints—especially certain SharePoint pages—require delegated access or specific site permissions, which is why results may not be returned in this mode.

To resolve this, you should ensure your app has the appropriate Application permissions (e.g., Sites.Read.All) in Azure AD instead of delegated permissions, and that admin consent has been granted. This will allow your Copilot agent to access the SharePoint knowledge sources correctly using Manual Authentication.

Let us know if this resolves the issue.

Was this reply helpful? Yes No
Suggested answer

rezarizvii 118 on at

Like (0)

Report
Copy link

Link copied!
Hi @SanjayAdsure201, hope you are doing well.

Manual auth with client secret is the issue here. With Microsoft Copilot Studio, SharePoint knowledge sources rely on delegated user context to resolve content.

What you can do

Option 1: Use delegated auth in your custom app

Implement OAuth (Auth code flow / PKCE) in your React app

Pass user token to Copilot

This aligns with how Copilot expects to access SharePoint

Option 2: Don’t use SharePoint as knowledge source

Move content to:

Dataverse

External API

Then call it via actions (works with app-only)

If this reply helped you in any way, please give it a Like 💜 and in case it resolved your issue, please mark it as the Verified Answer ✅.

Was this reply helpful? Yes No
SanjayAdsure201 83 on at

Like (0)

Report
Copy link

Link copied!

Thank you @AP-26031104-0 for your reply. I have added the Application permission for Sites.Read.All and also requested for Admin consent. Let me check this & update here once done.

Thanks,

Sanjay Adsure

Was this reply helpful? Yes No
SanjayAdsure201 83 on at

Like (0)

Report
Copy link

Link copied!
Thank you @rezarizvii for your reply.

May I know more details about the Option 1: Use delegated auth in your custom app you mentioned.

Option 1: Use delegated auth in your custom app

Implement OAuth (Auth code flow / PKCE) in your React app

Pass user token to Copilot

This aligns with how Copilot expects to access SharePoint

I'm not well versed with react (it's been developed by other person) so would really appreciate if you can provide some link or step by step way to do this.

Thanks,

Sanjay

Was this reply helpful? Yes No
rezarizvii 118 on at

Like (0)

Report
Copy link

Link copied!

Hi @SanjayAdsure201,

There is a library in React that we can use to authenticate with Microsoft Entra called MSAL.js. Using MSAL, users can request an access token generated after authenticating with MS Entra to make external API calls in their custom apps. You need to create an app registration, assign the API permissions you think you may need, and then call the MSAL function `aquireTokenSilent()` to get the delegated access token which has the context of the user who has logged-in.

The idea was to use that generated delgated token with Copilot.

Here are some articles you can reference:
Acquire and cache tokens with Microsoft Authentication Library (MSAL) - Microsoft identity platform | Microsoft Learn
Pass custom state in authentication requests (MSAL.js) - Microsoft identity platform | Microsoft Learn
Overview of the Microsoft Authentication Library (MSAL) for Python - Microsoft Authentication Library for Python | Microsoft Learn

Was this reply helpful? Yes No